I know what you've got (Firefox Extensions)

Update: I removed the JS PoC from the template. Was messing up IE.

Update: Some generous person, who sadly didn't leave their name, supplied me with a bunch more Firefox Extension signatures. Way cool! I updated the PoC code on the blog. Enjoy!


RSnake discovered a great way to detect installed Firefox extensions using the chrome: protocol handler. I liked it so much and in keeping CSS/JS History Hack, I just had to have some proof-of-concept code for the blog. I improved upon his design a bit, making it more complete as far as popular extensions go and easier to add new signatures. On the right side column look for the "I know what you've got" heading. Below you should see a list of detected extensions, if any. Again, I'm not capturing this data, just redisplaying it.

The chrome protocol handler enables reaching into the FF browser extensions folder to access image resources. For instance the Google Toolbar has chrome://google-toolbar/skin/icon.png. For detection create an IMG DOM Object with an onload event handler. If the onload event handler fires, you know the extension is there because the URL is unique.

I put in signatures for Adblock Plus, Auto Copy, ColorZilla, Customize Google, DownThemAll, Faster Fox, Flash Block, FlashGot, Forecastfox, Google Toolbar, Greasemonkey, IE Tab, IE View, JS View, Live HTTP Headers, MeasureIt, SEO For Firefox, SEOpen, Search Status, Server Switcher, StumbleUpon, Tab Mix Plus, Torrent-Search Toolbar, User Agent Switcher, View Source With, Web Developer.

Source:

// popular extensions.
var e = {
 "Adblock Plus" : "chrome://adblockplus/skin/adblockplus.png",
 "Auto Copy" : "chrome://autocopy/skin/autocopy.png",
 "ColorZilla" : "chrome://colorzilla/skin/logo.png",
 "Customize Google" : "chrome://customizegoogle/skin/32x32.png",
 "DownThemAll!" : "chrome://dta/content/immagini/icon.png",
 "Faster Fox" : "chrome://fasterfox/skin/icon.png",
 "Flash Block" : "chrome://flashblock/skin/flash-on-24.png",
 "FlashGot" : "chrome://flashgot/skin/icon32.png",
 "Forecastfox" : "chrome://forecastfox/skin/images/icon.png",
 "Google Toolbar" : "chrome://google-toolbar/skin/icon.png",
 "Greasemonkey" : "chrome://greasemonkey/content/status_on.gif",
 "IE Tab" : "chrome://ietab/skin/ietab-button-ie16.png",
 "IE View" : "chrome://ieview/skin/ieview-icon.png",
 "JS View" : "chrome://jsview/skin/jsview.gif",
 "Live HTTP Headers" : "chrome://livehttpheaders/skin/img/Logo.png",
 "MeasureIt" : "chrome://measureit/skin/measureit.png",
 "SEO For Firefox" : "chrome://seo4firefox/content/icon32.png",
 "SEOpen" : "chrome://seopen/skin/seopen.png",
 "Search Status" : "chrome://searchstatus/skin/cax10.png",
 "Server Switcher" : "chrome://switcher/skin/icon.png",
 "StumbleUpon" : "chrome://stumbleupon/content/skin/logo32.png",
 "Tab Mix Plus" : "chrome://tabmixplus/skin/tmp.png",
 "Torrent-Search Toolbar" : "chrome://torrent-search/skin/v.png",
 "User Agent Switcher" : "chrome://useragentswitcher/content/logo.png",
 "View Source With" : "chrome://viewsourcewith/skin/ff/tb16.png",
 "Web Developer" : "chrome://webdeveloper/content/images/logo.png",
 "Unhide Passwords" : "chrome://unhidepw/skin/unhidepw.png",
 "UrlParams" : "chrome://urlparams/skin/urlparams32.png",
 "NewsFox" : "chrome://newsfox/skin/images/home.png",
 "Add N Edit Cookies" : "chrome://addneditcookies/skin/images/anec32.png",
 "GTDGmail" : "chrome://gtdgmail/content/gtd_lineitem.png",
 "QuickJava" : "chrome://quickjava/content/js.png",
 "Adblock Filterset.G Updater" : "chrome://unplug/skin/unplug.png",
 "BBCode" : "chrome://bbcode/skin/bbcode.png",
 "BugMeNot" : "chrome://bugmenot/skin/bugmenot.png",
 "ConQuery" : "chrome://conquery/skin/conquery.png",
 "Download Manager Tweak" : "chrome://downloadmgr/skin/downloadIcon.png",
 "Extended Cookie Manager" : "chrome://xcm/content/allowed.png",
 "FireBug" : "chrome://firebug/content/firebug32.png",
 "FoxyTunes" : "chrome://foxytunes/skin/logo.png",
 "MR Tech Disable XPI Install Delay" : "chrome://disable_xpi_delay/content/icon.png",
 "SessionSaver .2" : "chrome://sessionsaver/content/ss.png",
 "spooFX" : "chrome://spoofx/skin/main/spoofx.png",
 "Statusbar Clock" : "chrome://timestatus/skin/icon.png",
 "Torbutton" : "chrome://torbutton/skin/bigbutton_gr.png",
 "UnPlug" : "chrome://unplug/skin/unplug.png",
 "View Source Chart" : "chrome://vrs/skin/vrssmall.png",
 "XPather" : "chrome://xpather/content/iconka.png", 

};

if (is_mozilla) {
 showExtensions(); 
}

function showExtensions() {
 for (var i in e) {
  var img = document.createElement("img");
  img.setAttribute("border", '0');
  img.setAttribute("width", '0');
  img.setAttribute("height", '0');
  img.setAttribute("onload", "document.getElementById('ext').
appendChild(document.createElement('li')).innerHTML='" + i + "'");
  img.setAttribute("src", e[i]);
 }

}

If you have more signatures with extension names and unique-chrome-url, comment them in and I'll add them to the list. And I agree with RSnake that we'll have to dig deeper into the chrome handler to see if any issues exist with the extensions. So much research, so little time.